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ABSTRACT 

The increase of the orbital debris environment in 
low-earth orbit has prompted NASA to develop 
analytical tools for quantifying and lowering the 
likelihood of crew loss following orbital debris 
penetration of the International Space Station 
(ISS). NASA uses the Manned Spacecraft and 
Crew Survivability (MSCSurv) computer 
program to simulate the events that may cause 
crew loss following orbital debris penetration of 
ISS manned modules, including 

(1) critical cracking (explosive decompression) 
of the module, 

(2) critical external equipment penetration (such 
as hydrazine and high pressure tanks) 

(3) critical internal system penetration 
(guidance, control, and other vital 
components) 

(4) hazardous payload penetration (furnaces, 
pressure bottles, and toxic substances) 

(5) crew injury (from fragments, overpressure, 
light flash, and temperature rise), 

(6) hypoxia from loss of cabin pressure, and 

(7) thrust from module hole causing high 
angular velocity (occurring only when key 
Guidance, Navigation, and Control [GN&C] 
equipment is damaged) and , thus. 
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preventing safe escape vehicle (EV) 
departure. 

MSCSurv is also capable of quantifying the “end 
effects” of orbital debris penetration, such as the 
likelihood of crew escape, the probability of each 
module depressurizing, and late loss of station 
control. By quantifying these effects (and their 
associated uncertainties), NASA is able to 
improve the likelihood of crew survivability 
following orbital debris penetration due to 
improved crew operations and internal designs. 
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OBJECTIVE 

The increase in man-made debris in low-earth 
orbit (LEO) has prompted NASA to seek new, 
highly accurate methods for modeling orbital 
debris hypervelocity impacts on spacecraft. 
Although debris impacts to the International 
Space Station (ISS) manned modules can cause 
serious and expensive damage, not all impacts 
cause penetrations, and not all penetrations lead 
to the death of one or more crewmembers. 

NASA desires to implement its goal of 
maximizing crew safety by computing the 
likelihood of loss from orbital debris penetration, 
and by identifying alternative internal ISS 
designs and crew procedures that reduce that 
likelihood. To help achieve this goal, NASA 
Marshall Space Flight Center (MSFC) contracted 
with the University of Denver Research Institute 
(DRI) to develop and use a computer code to 
model impacts and to quantify damage severe 
enough to cause deaths. 

Our objectives in the analyses performed in early 
2001 were: 

(1) To quantify the parameter R , the probability 
of loss given a penetration, and its two- 
sigma upper and lower bounds for individual 
ISS modules, for Assembly Stage 12A, 

(2) To examine how R is affected by the smaller 
volumes, shorter crew protocols, and other 
features of earlier assembly configurations, 

(3) To use predicted R factors in conjunction 
with the probability of no penetration (PNP) 
results from NASA Johnson Space Center 
(JSC) to estimate probabilities of no loss 
(PNL) for the Stage 12A configuration, and 

(4) To examine the effect of alternative crew 
operations on reducing R factors. 

In addition to meeting these objectives, we 
recently refined the MSCSurv program and 
associated data files to better model external and 
internal equipment and crew operational 
protocols. These code improvements and insights 
should result in more accurate prediction of R 
factors and in improved safety of operations 
following orbital debris penetration of the 
International Space Station manned modules. 

BACKGROUND 

Since 1992, NASA and DRI have developed and 
refined the Manned Spacecraft and Crew 
Survivability (MSCSurv) computer code to 
determine the likelihood that an orbital debris 
penetration causes death of crew members at the 
“assembly complete” stage of the International 


Space Station. MSCSurv is a Monte Carlo 
simulation that computes the probability of 
occurrence of crew loss from orbital debris 
penetration. Within the code, a penetration may 
cause one of seven possible failure modes: 

( 1 ) Critical external equipment failure 

(2) Manned module critical cracking (or 
“unzipping”) 

(3) Critical internal systemic equipment failure 

(4) Critical internal payload equipment failure 

(5) Crew hypoxia during escape or rescue 

(6) Fatal fragmentation injury to crew 

(7) Critical thrust from module hole causing 
high angular velocity (occurring only when 
key Guidance, Navigation, and Control 
[GN&C] equipment is damaged) and, thus, 
preventing safe escape vehicle (EV) 
departure 

Note that several of the failure modes (for 
example, modes 1 through 4, and 7) cause severe 
damage to the station that may preclude re- 
occupation without extensive repair. 

Based on these damage modes, the probability of 
no loss (PNL) of the station's crew due to impact 
by orbital debris particles may be computed 
using the equation 

PNL = PNP r (1), 

where PNP is the probability of no penetration. 

In equation (1), PNP is a function of particle 
flux, module surface area, exposure time, and 
shield ballistic limit, and is determined by 
NASA-JSC using the BUMPER code. R is a 
function of hypervelocity damage and crew and 
station-related parameters. As outlined below, R 
is calculated within the MSCSurv code using the 
seven failure modes. A more detailed 
description is given in Reference [1]. 

To calculate R, MSCSurv: 

(1) Randomly generates a large number of 
debris particles (size, velocity, and approach 
direction) based on selected NASA orbital 
debris environment models, 

(2) Selects a space station impact location for 
each particle generated, based on exposure 
of the station from this approach direction, 

(3) Determines which of these particles 
penetrates the station shields based on the 
interacting particle and shield parameters, 

(4) Predicts the resulting damage from each 
particle that penetrates the station, 

(5) Compares the predicted damage from the 
impact to critical levels required to induce 


2 



loss of one or more crew members, 
considering the exposure of the crew 
members to these damage levels and their 
ability to escape from them, and 
(6) Quantifies R for each module and the 
module cluster taken as a whole, averaged 
over millions of simulated penetrations 
(billions of impacts). 

To perform (3), MSCSurv uses the same 
empirical and analytical ballistic limit relations 
used by the BUMPER code to quantify the 
number of particles that will penetrate the 
spacecraft shields. Step (4) requires use of 
hypervelocity impact damage prediction 
equations to determine hole size, crack length, 
and depth of penetration into the interior of the 
module. While steps (3) and (4) are related 
closely to hypervelocity impact phenomenology, 
step (5) requires other assumptions regarding the 
capability of the station to tolerate damage as 
well as the reactions of the crew and their 
physical capability to withstand and escape 
harm. The details of MSCSurv Version 4.0 have 
been thoroughly documented in MSCSurv 
Version 4.0 User’s Guide [2], 

Once completed, these calculations determine an 
R factor prediction for each module based on the 
seven failure modes. By altering the input 
parameters regarding crew operations, internal 
arrangement of the ISS modules, and other 
design factors, the analyst can compare the 
safety of modes of ISS operation. This 
comparison points to changes that could be made 
to lower overall probability of crew loss. 

ENVIRONMENT 

Our analyses used the following general 
assumptions for the orbital debris environment: 

Orbital debris environment model = ORDEM 96 
(NASA-JSC) 

Station orbital inclination = 51.6° 

Station orbital altitude = 418 km 
Year = 2003 

Solar flux at 10.7 cm = 166 Janskys 

Debris population growth factor, N =.20 

Orbital debris particle density = 2.8 g/cm 3 

PHYSICAL MODEL AND BALLISTIC LIMIT 
RELATIONS 

Johnson Space Center (JSC) provided the 
geometry model and ballistic limit relations used 


for these analyses, which corresponds to the 
BUMPER model used for the Stage 12A 
analyses. 

The ballistic limit relations associated with each 
of the external shield designs can be found in 
“ISS Meteoroid & Debris Integrated Threat 
Assessment #9 (ITA-9)” found in Reference [3]. 

DAMAGE MODELS 

Once MSCSurv has established that a 
penetration has occurred, it calculates the size of 
the hole using one of two models: the Burch 
model or the Schonberg/Williamsen (SAV) 
model, Reference [4]. The SAV model is an 
empirical model based on data obtained by 
laboratory testing of station- specific shield 
configurations. It is used in all instances in 
which the actual shield parameters resemble the 
tested shield parameters within a 25% variance 
of standoff (distance between shielding 
materials) and within a 50% variance of rear wall 
thickness. The Burch model or Burch D90 
damage equation is a generic hole-size prediction 
model developed in the 1960's for aluminum 
plates and is used for those shields where no 
SAV model is available. 

Table 1 shows a predicted distribution of hole 
sizes within the manned modules following 
orbital debris penetration, as calculated by 
MSCSurv 6.0. Note that although the RSA 
modules receive more penetrations, the average 
penetration is smaller than that predicted for the 
NASA/ESA/NASDA (i.e., "NASA" type) 
modules. This is because the general design of 
the RSA module shields more easily allows 
penetrations by orbital debris than their NASA 
counterparts, due to shorter standoffs and thinner 
materials used. When holes occur, they are (on 
average) smaller in RSA modules than those 
allowed by the generally more robust shielding 
of the NASA module design. 

MSCSurv calculates crack lengths in a fashion 
similar to that used to calculate hole sizes. It 
uses either an empirical SchonbergAVilliamsen 
crack-size model (again, applied to shield types 
with less than a 25% variance in standoff and 
50% variance in rear-wall thickness compared to 
tested configurations) or simply multiplies the 
hole size from the Burch model by a user- 
specified factor (a nominal value of 2 for the 
analyses presented in this report). Table 2 shows 
MSCSurv 6.0's predicted distribution of crack 
sizes within the manned modules following 
orbital debris penetration. Note that the average 
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predicted crack sizes on the RSA modules are 
smaller than those on the NASA/ESA/NAS DA 


modules (similar to the trends for hole sizes). 


Table 1 Predicted Pressure Wall Hole Distribution for Manned Modules (for One Million 
Penetrations) 
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Table 2 Predicted Crack Size Distribution for Manned Modules (for One Million Penetrations) 




mm 


mm 

n 

9 

I 

I. ; sis 

-Si-.r 


US Lab 

1391 50 

26 53 

■HQI 




5.85 

4.79 

3.60 

2 79 

2.47 

2.42 

Node-1 

1 09888 

43 08 

27.781 




2.96 

2.17 



0.31 

0 19 

FGB 

503709 

2.14 





4.69 

20.52 


MiXiI3 

■ W »1 


Service AFT 

2741015 

65.18 

maw A 


1.19 

1.23 

1.05 

0.51 


3.11 

0.55 


SPP-1 

687245 

15.47 

71.111 

12.94 

0.36 


■WEI 


»HIi] 

■win 

■HOI 


HPGC 

50490 






4.77 

3.60 

2 46 

2.23 

1.52 

BEI 

Airlock 

30825 

17 59 







4.03 



7.12 


627269 

6.92 

45.94 

45.36 

0.96 

0.37 

0.32 

Mam 

0.01 

EH] 

0.00 

ESI 

PMA-1 

32672 

37 32 

24 03 

12.34 

7.91 

6.67 

5 79 

322 

1.50 

0 81 

0.23 

Eifil 

PMA-2 

42968 

30.88 

19.95 

12.00 

9.23 

7.40 

6.47 

4.61 

2.92 

2.21 

1.79 

0 80 

PMA-3 

18323 

31.71 

20.56 

11.79 



5.95 

3.99 

2.63 

1.77 

1.35 

w>mi 

Progret* 

2425301 

83.65 

3.70 

3.30 

2.31 

2.51 

2.77 

1.03 

lift! 


0.05 


Service FWD 

82320 

1.20 

14.72 

45.16 

8.75 

15.77 

■ FWK1 

2.43 

KS3 


0.11 

mg 

iiiiii 

m.... - 

mm-: 

82.39 

4.00 

.‘it s '.Ti* ir ■ 

m'FIi 

mm 

5f- 

Mt :: 
!§:=■- 

wsm 


•.«?- ” r - 

is.. 

m i 

mi 


HrVf : "• 

Sit':' 

IIM. 

0.25 

i 


Critical Cracking 

Manned module critical cracking (also called 
module "unzipping”) is the rupture of a manned 
module caused by unstopped crack growth 
following a pressure wall penetration by orbital 
debris. Every manned module pressure wall 
design has a unique susceptibility to this failure 
mode that is measured by the pressure wall's 
critical crack length (i.e., the crack size that, if 
exceeded, would cause the wail to "unzip" or 
crack over a long enough distance to rupture the 
module). We calculate the critical crack length 


for a module using a combination of design 
parameters, including pressure wall thickness, 
curvature, alloy, and state of stress. Note that 
each module may have several critical crack 
lengths, due to different rear wall curvatures and 
thicknesses in local areas of the module. 

Critical External Equipment Penetration 
MSCSurv checks one of three possible failure 
modes for external equipment. 
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First, the code decides whether or not the 
penetration causes an immediate detonation of 
the propellant within fuel tanks. 

If detonation does not occur, the code calculates 
whether or not the pressurized propellant tanks 
or gas bottles “unzip”. We assume that unzipping 
of one of these elements causes crew loss 
through fragmentation or breach of the 
underlying pressure wall. 

If an unzipping event does not occur, MSCSurv 
calculates whether a thrust from one of these 
external tanks causes the external tank to break 
away from the module. We assume this causes a 
catastrophic failure of the ISS by ripping a hole 
in the pressure wall. 

Critical Internal Systemic Equipment 
To perform these calculations accurately, we 
identified all Criticality 1 and integral (danger- 
producing) internal system elements aboard ISS 
manned modules. We then associated each of 
these internal systems with one or more external 
elements in the data files. 

Critical Internal Payload Equipment 
To perform these calculations accurately, danger 
producing internal payloads (such as high 
pressure containers) were identified and 
associated with one or more external elements in 
the data files, similar to the process used for 
Critical Internal Systemic Equipment. 

Hypoxia 

Hypoxia occurs when people pass out and die 
from lack of oxygen. To prevent deaths from 
hypoxia, the crew must seal off a leaking module 
or sector of the space station, or they must get 
into the escape vehicle and leave. In the event of 
a depressurizing leak, the crew's locations, 
responses, reaction times, movement rates, 
isolation methods, etc., are critical to saving 
themselves. Their responses can also be critical 
to saving the ISS. 

Recognizing the criticality of crew response, we 
created a new crew response subroutine tailored 
to Stage 12 A, using SSP 50506 as a guide. 

In general, when the depressurization alarm 
sounds, the crew first moves to the Service 
Module for discussion and preliminary actions. 
Assuming no injury, they next move to the 
Soyuz where they perform a leak check. 

Provided the leak check confirms that the Soyuz 
is not leaking, the crew uses the current pressure 
and pressure rate readings to compute the time 
remaining until the cabin pressure reaches a 


predetermined minimum value ("bail pressure"); 
this time is known as the "reserve time." If the 
reserve time is at least 30 minutes, the crew re- 
enters the station and attempts to isolate the 
leaking module. If the reserve time is less than 
30 minutes, they evacuate the station in the 
Soyuz. 

Injuries necessitate specialized reactions to a 
penetration. MSCSurv treats injured crew 
members as stationary “objects” that must be 
rescued by the other crew members. The crew 
must find the injured crew member, stabilize 
him, and move him from the penetrated module, 
then isolate the module (if time permits). It is 
important to note that if a crew member is 
injured in this simulation, the rest of the crew 
will NEVER depart the station without him. An 
injured crewman is never abandoned. 

A summary of some of the key assumptions 
affecting hypoxia for these analyses is given 
below: 

(1) The bail pressure is set for 5 10 mm Hg 
(9.859 psi) with a triangular variance of plus 
or minus 10%. 

(2) The critical pressure for the onset of hypoxia 
is 9.5 psi with no variance, 

(3) Onboard leak detectors take five minutes to 
give their first reading (with a uniform 
variance of plus or minus 20%). The five 
minutes begins once all crewmen arrive at 
the Soyuz. The detectors are assumed to be 
50% reliable (with a uniform variance of 

± 20%). In case the detectors do not work, 
the crew must follow with an ordered-hatch- 
closure protocol (time permitting). 

(4) No hatches are considered closed in normal 
operations. 

(5) A crew member can hear a hole larger than 
2 centimeters (with a triangular variance of 
± 50%), if he enters the penetrated module. 

If a crew member hears the hole, he stops 
and isolates the hole. 

Fatal Injury 

Fatal injury occurs when a crewman is struck by 
fragments of the penetrating particle or 
fragments of the pressure wall. In order for a 
fatal injury to occur, MSCSurv requires two 
conditions to be met: 

The impacting particle must penetrate through 
racks or other internal equipment in its path. 

A crewman must be located in close proximity to 
the site of penetration. We divided the entire 
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space station into crew stations, each about one 
meter wide along the cylindrical axis of the 
modules. When a penetration occurs, MSCSurv 
determines which crew station was penetrated. 

A crew member must be present in that station or 
a directly adjacent station in the same module for 
a fragmentation injury to occur. 

EMERGENCY VEHICLE DEPARTURE 

The crew departs from the station in the Soyuz 
when: 

(1) Bail pressure is reached before the hole is 
isolated, 

(2) Any crew injury occurs, 

(3) The critical module (Service Aft) 
depressurizes, or 

(4) Sealing off the depressurizing module would 
isolate the crew from the Soyuz if they 
stayed aboard (in Stage 12A analyses, this 
includes penetrations to the Service Forward 
and the Docking Compartment). 

If one of the seven critical loss modes occurs, 
MSCSurv does not tally the occurrence of crew 
departure. However, MSCSurv will tally crew 
departure in cases of nonfatal injury, loss of 
control of station, and critical depressurization. 

RESULTS 

Table 3 shows the mean R factors computed by 
MSCSurv using baseline parameters and the 
ITA-9 assembly stage 12 A configuration. 

The overall mean R factor of 0.285 indicates that 
28.5 percent of the time a penetration of the 
station by orbital debris results in one or more 
deaths. As discussed in a previous section, the 
NASA portion of the station tends to be tougher 
to penetrate but in the event of a penetration, the 
hole sizes and crack lengths tend to be larger — 
penetration depths tend to be larger as well. It is 
not surprising that MSCSurv predicts an R factor 
of 0.447 for the NASA side of the station and 
only 0.278 for the RSA side. 

The overall R factor is determined by weighting 
each module’s R factor by its overall likelihood 
of penetration. Since about 96% of all 
penetrations of the station occur on the RSA 
side, the RSA R factors drive the overall R 
factor. Hypoxia is by far the largest contributor 
to the R factor on both the RSA and NASA sides 
of the station. Critical external equipment 
penetrations and critical internal payload 
penetrations are the second and third leading 
contributors to the overall R factor. Much 
equipment data has been obtained and 


incorporated into these analyses. Further data 
would improve the accuracy of the results. 

Nonfatal injuries, late loss of station control and 
critical module depressurization are not counted 
in the total R factors but are presented in 
columns H, I, and J of Table 3. Column K shows 
the total occurrence of all ten events. This 
baseline run predicts that 57.4% of penetrations 
will result in one of these ten events. 
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Figure 1 Number of Impacts per Element 
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Figure 2 Numbers of Penetrations per 
Element 
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Figure 3 Numbers of Penetrations Leading to 
Crew Loss per Element 
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Table 3 Mean Probability of Station or Crew Loss Given an OD Penetration — 12A 


MODULE 

RATIO= 

EB 

B + 

IB 

D + 


F + 

G 

H 

HI 

j 

K 

(NASA) 

0.447 

0.046 

0.007 

0.039 

0.031 






0.163 

0.631 

(RSA) 

0.278 

0.001 

0.068 

0.011 

0.034 





0.018 

0.181 

0.572 

STATION= 

0.285 

0.003 

0.066 

0.012 

0.034 

0.163 




0.017 

0.181 

0.574 


Legend for table headings 

A = Critical cracking (unzipping) 

B = External equipment penetration 
C = Internal systemic equipment penetration 
D = Internal experiment equipment penetration 
causes critical injury 
E = Hypoxia loss 
F = Fragmentation loss 
G = Thrust induced angular velocity prevents 
departure from station 

H = Fragmentation or secondary factors cause 
non-critical injury 
I = Late loss of station control 
J = Critical module depressurizes 
K = Total of A-J. 


SENSITIVITY STUDIES 

In addition to analyzing the baseline case, we 
performed analyses to examine the effects of 1) 
utilizing oxygen masks, 2) increasing the bail 
pressure, and 3) combining the use of oxygen 
masks with higher bail pressures. Table 4 shows 


the resulting R factors of these analyses, with the 
hypoxia contribution to R broken out separately. 
A total of six run types were performed: 

(1) Baseline 

(2) Bail pressure increased to 610 mm Hg - 
from the baseline value of 5 10 mm. 

(3) Bail pressure increased to 660 mm Hg. 

(4) Baseline AND Masks - Crew puts on 
oxygen masks after the depressurization 
alarm sounds. The mask is assumed to be 
functional for 20 minutes from the time a 
crew member dons it. The critical pressure 
while wearing the mask drops from 9.5 psi 
to 3.5 psi. 

(5) Bail pressure of 610 mm Hg AND masks 

(6) Bail pressure of 660 mm Hg AND masks. 

The results of these runs show that hypoxia 
losses can be cut by more than half by using 
oxygen masks and a bail pressure of 610 mm Hg. 
The lowest R factors of all were obtained when 
oxygen masks and a bail pressure of 660 mm Hg 
were used. 


Table 4 Comparisons of R Factors from Options to R Factors from Baseline 


MODULE 

Baseline 
(510 mm 
Bail 

Pressure) 

R 

Baseline 
(510 mm 
Bail 

Pressure) 

Hypoxia 

R 

610 mm 
Bail 

Pressure 

R 

610 mm 
Bail 

Pressure 

Hypoxia 

R 

660 mm 
Bail 

Pressure 

R 

660 mm 
Bail 

Pressure 

Hypoxia 

R 

Mask 
(5 1 0 mm 
Bail 

Pressure) 

R 

Mask 
(510 mm 
Bail 

Pressure) 

Hypoxia 

R 

610 mm 
Bail 

Pressure 
+ Mask 
R 

610 mm 
Bail 

Pressure 
+ Mask 
Hypoxia 
R 

660 mm 
Bail 

Pressure 
+ Mask 
R 

660 mm 
Bail 

Pressure 
+ Mask 
Hypoxia 
R 


0.447 

0.295 

0.434 

0.285 

0.420 

0.263 

0.279 

0.111 

0.288 

0.119 

0.281 

0.114 



0.157 

0.227 

0.109 

0.212 

0.088 

0.216 

0.092 

0.191 

0.063 

0.180 

0.068 

STATION 

0.285 

0.163 

0.236 

0.117 

0.221 

0.096 

0.219 

0.092 

0.195 

0.066 

0.185 

0.060 


7 
















































































PREDICTIONS FOR OVERALL 
PROBABILITY OF CREW LOSS FOR STAGE 
12A 

The objective of this section of the report is to 
use the R factors in conjunction with the 
probability of no penetration (PNP) results 
obtained from BUMPER, in order to estimate the 
overall probability of no loss (PNL) for Stage 
12A. As stated in the Introduction, the PNL is 
computed using the equation: 


PNL = PNP r 

Table 5 shows a roll-up of predicted PNPs and 
their corresponding PNLs using the mean R 
factors calculated for Stage 12 A. The PNPs for 
earlier stages were not broken out in the JSC 
report for ITA-9, so DRI performed the 
BUMPER run for Stage 12 A used here. 


Table 5 Predicted Probability of No Loss for Stage 12 A 


MODULE 

PNP 

R 

PNP k = PNL 

(NASA) 

0.9998213 

0.447 

0.9999201 

(RSA) 

0.9959365 

0.278 

0.99888687 

STATION= 

0.9957585 

0.285 

0.9987893 


CONCLUSIONS 

The Manned Spacecraft Crew Survivability 
computer program is a powerful analytical tool 
that enables ISS designers, managers, and safety 
specialists to estimate the probability of crew or 
spacecraft loss due to orbital debris impact. 
MSCSurv calculates the probability of crew loss 
following penetration of the space station by 
simulating millions of penetrations of the ISS 
manned modules and determining which 
penetrations lead to crew loss due to seven 
critical failure modes: 

• Critical external equipment failure 

• Manned module critical cracking 
(unzipping) 

• Critical internal systemic equipment failure 

• Critical internal payload equipment failure 

• Hypoxia during escape or rescue 

• Fatal fragmentation injury 

• Thrust from module hole causing high 
angular velocity (occurring only when key 
GN&C equipment is damaged) and, thus, 
preventing safe EV departure. 

During 2001, MSCSurv and the associated data 
files were extensively modified to accommodate 
changes in the space station shielding and 
geometry, crew operations, and internal/external 


equipment configurations. We offer the 
following major conclusions regarding the 
results obtained thus far using MSCSurv and the 
ISS Stage 12 A configuration: 

( 1 ) Roughly 29% of all orbital debris 
penetrations lead to the death of one or more 
crew members at Stage 12 A. This lethality 
rate could be significantly reduced through 
improved crew operations. 

(2) Using the values of R and PNP we predict 
the likelihood of death due to orbital debris 
penetration at Stage 12 A to be between 
0.09% and 0.18%,with a mean of 0.12%. 

(3) Modules with better shielding result in a 
lower overall probability of crew loss, even 
though their hole sizes (and R factors) are 
larger should a penetration occur. 

(4) Roughly 4 1 % of the penetrations where all 
crewmen survive (which is 29% of all 
penetrations) will require the crew to depart 
from the space station in the Soyuz. 

(5) The largest contributors to the overall R 
factor are hypoxia (16%) and penetrations to 
external equipment (7%); 80% of the R 
factor can be attributed to one of these two 
critical failure modes. Improvements in 
crew protocols can significantly reduce 
hypoxia deaths. Higher fidelity input data 
for external equipment would greatly 
improve the accuracy of the overall 
analyses. 
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(6) These predictions contain hole size and 
penetration depth equations that are large, 
continuing sources of uncertainty. NASA 
needs a better multi-plate penetration 
equation, effective to 15 km/sec for three or 
more spaced aluminum plates. This will 
drastically increase our confidence in these 
predictions. 



I Critical CrarkO 1% 

I Eitemal Equipment 
66 % 

□ Internal Systemic 
1 . 2 % 

□ Internal Payload 3 4% 

■ Hypona 16 3% 

■ InjuiyC B% 

■ Thru st 0 1 % 
oNontatal Injury 9 1 % 

■ Control Loss 1 7 % 

■ Service Art 
Depressurizes 18 1% 

□ No CraveLriss or 
Departure 42 1 % 


Figure 4 Assembly Stage 12A Configuration 


FUTURE WORK 

DRI will continue these analyses through at least 
this year in support of the International Space 
Station. Our goals are: (1) to improve the fidelity 
of the model, (2) to quantify and improve crew 
and space station survivability following orbital 
debris penetration by suggesting better 
procedures and improved internal module 
designs, and (3) to provide R factors for select 
earlier stage configurations. This Stage 12A 
assessment is the first R factor computation to be 
performed on a configuration preceding 
complete assembly. 


(2) Increase the bail pressure to 660 mm Hg. 

— The trade study shows that by using 660 
mm Hg versus the baseline 5 10 mm Hg, 
hypoxia drops from 16% to 10%. 

— The trade study also shows that by using 
660 mm Hg versus the baseline 510 mm Hg, 
crew departure rate increases from 29% to 
40% following orbital debris penetration. 

— Further analyses to refine the optimum 
bail pressure using MSCSurv could prove 
useful. 

(3) Provide indication to crew as soon as 
possible as to the severity of the leak using 
improved leak detection and measuring 
equipment. 
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RECOMMENDATIONS 

We make the following recommendations based 
on findings from this and past assessments: 

( 1) Change crew protocol to include use of 
oxygen masks. 

— Our trade study shows that using oxygen 
masks reduces hypoxia from 16% to 9% 
following orbital debris penetration. 
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